Why hospitals could prepare for CIRCIA before CISA wrote its rule

The week

On March 15, 2022, President Biden signed the Consolidated Appropriations Act, 2022, which included the Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA. The law requires covered entities in critical infrastructure sectors to report covered cyber incidents to CISA within 72 hours after they reasonably believe one has occurred. It also requires them to report ransom payments made in response to ransomware attacks within 24 hours of payment. Key definitions, including which entities are covered and what counts as a covered incident, were left to a CISA rulemaking. The law set a proposed rule due within 24 months and a final rule within 18 months after that. It also limited how reported information could be used, including in regulatory enforcement. Health care and public health is one of the designated critical infrastructure sectors.

Most laws take effect on a date. CIRCIA would take effect only when CISA finished a rule, and the statute gave it more than three years to do so. Hospitals and health systems knew in March 2022 that a federal reporting duty was coming and roughly what it would require. They did not know whether it would cover them or exactly what would count. Waiting for the final rule was a defensible choice. It was also a missed opportunity, because the statute had already fixed the parts that would be hardest to build: a 72-hour clock triggered by reasonable belief, and a 24-hour clock triggered by payment. Each clock forces a decision inside incident command. A third task, reconciling the new duty with existing ones, was also independent of the details. We take those three in turn: the incident determination, the payment report, and the reporting map.

The incident determination

The 72-hour clock starts when an entity reasonably believes a covered incident has occurred. That is earlier than certainty, and much earlier than the end of a forensic investigation. Someone has to judge, in the first day or two of an incident, whether it meets a threshold the rule would define. That judgment and its timing must be recorded, because the clock runs from it.

Hospitals already make comparable calls under pressure. They decide when to open incident command, when to divert ambulances, when to move to downtime procedures and when to notify their cyber insurer. What CIRCIA added was a documented determination against a federal definition on a short deadline. The work that did not depend on the rule was to name who makes that determination, with a deputy, and what facts they need. The record should show when the belief formed and on what evidence.

A hospital with a defined severity scale could later map the final definition onto it. The statute’s minimum description of a covered incident already turned on substantial loss of confidentiality, integrity or availability, serious impact on the safety of operational systems, or disruption of operations. A scale that already records those effects for each incident makes the mapping mechanical. A scale that records only technical severity makes it a fresh judgment every time.

The determination sits uneasily with the instinct to wait for facts. Legal teams often prefer to say nothing until an investigation concludes. A reasonable-belief trigger does not allow that. Incident commanders and counsel needed to agree in advance that an early, provisional report, updated later, is the expected pattern.

The payment report

The ransom payment clock is shorter and simpler. It starts when payment is made. For a health system, the decision to pay is already among the gravest it can face. It weighs patient safety, sanctions exposure, insurance terms, law enforcement advice and reputation, and it is usually taken at the top of the organization with outside counsel and incident response firms involved.

CIRCIA added one more step: a report within a day of payment. The preparation was to make the report part of the payment decision itself. That means a named owner for the report, and a checklist capturing what the report would likely need as the decision is made: the amount, the currency and method, the instructions received, the intermediaries used and the circumstances. Payments are often made through a negotiator or incident response firm. The engagement letter should require that firm to supply the transaction details within hours. Organizations should check with counsel on the wider legal questions around payment, which go well beyond reporting.

The reporting map

A health system hit by a serious incident may owe several reports at once. HIPAA requires notice of breaches of unsecured protected health information to individuals and to the Department of Health and Human Services, and in larger cases to the media. Notice is due without unreasonable delay and no later than 60 days after discovery. State breach laws add their own triggers and timelines, and some states require notice to the attorney general. Payer contracts, research sponsors, accreditors and cyber insurance policies set further duties, some measured in hours. CIRCIA would add a federal report on a 72-hour clock.

These duties differ in trigger, recipient, deadline and content. A HIPAA breach concerns protected health information. A CIRCIA incident turns on effects on systems and operations. A ransomware attack that halts scheduling without touching patient records could trigger CIRCIA and not HIPAA. A quiet data theft might trigger HIPAA long before anyone saw an operational effect. The statute allowed an exception where an entity reports substantially similar information to another federal agency under an agreement with CISA, but whether such agreements would exist was unknown.

The preparation that made sense in 2022 was a single map of every reporting obligation the organization faced, with its trigger, recipient, deadline, required content and owner. Kept current, and walked through in tabletop exercises, it reduces the risk of missing a deadline during the confusion of an attack.

With hindsight

CISA published its proposed rule in April 2024. It proposed a broad definition of covered entities, with health care criteria that would reach many hospitals as well as certain drug and device manufacturers, and detailed report content. The proposal drew heavy comment on burden and on overlap with other federal reporting regimes. The final rule missed the statute’s October 2025 deadline and later internal targets. As of this writing in October 2026, it had not taken effect, so health systems should confirm its status and effective dates with counsel. Meanwhile, the February 2024 attack on Change Healthcare showed how one incident at a single intermediary could disrupt claims and pharmacy services across the country, and it strengthened the case for fast federal visibility. The health systems best placed for CIRCIA are those that built a documented determination process, a payment reporting step and a single reporting map while the rule was still being written.